New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security alert: pyyaml #732

Closed

pfirpfel opened this issue Jan 7, 2019 · 1 comment

Assignees

Contributor

pfirpfel commented Jan 7, 2019

GitHub reports an security alert regarding out pyyaml dependency:

CVE-2017-18342 :

Vulnerable versions: < 4.2b1
Patched version: 4.2b1

In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.

pfirpfel self-assigned this

pfirpfel mentioned this issue

Update insecure version of pyyaml #733

Merged

Contributor Author

pfirpfel commented Jan 9, 2019

see yaml/pyyaml#243

pfirpfel closed this as completed in #733

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment